Special Fields

Special fields are predefined columns available in every dataset. The $-prefixed names are reserved — user-defined columns cannot use them.

$raw — the property bag

Every dataset has a $raw column, a dynamic property bag containing the full ingested record. Use it to access fields that aren't part of the schema.

default | extend custom_field = $raw.my_custom_property

In permissive mode (default), bare identifiers that don't match a declared column are automatically resolved against $raw. See The $raw Column.

Time fields

timestamp — domain time

The primary timestamp representing when the event occurred in the source system. This is the "business time" of the event. Type: datetime.

default | where timestamp > datetime("2024-01-01T00:00:00Z")
default | where timestamp between [now() - 2d, now() - 1d]

Predicates on timestamp are extracted by the range analyzer and used to filter segments at the meta-service layer, reducing I/O.

ingest_time — ingestion time

The timestamp when the event entered Berserk. May lag timestamp due to processing delays, buffering, or late-arriving data. Type: datetime.

default | where ingest_time > datetime("2024-01-01T00:00:00Z")
// Find events whose ingestion lagged the source by more than 1 hour
default | where ingest_time - timestamp > 1h

ingest_time predicates also drive segment pruning, just like timestamp.

start_time and end_time — trace span fields

For distributed tracing data, start_time and end_time are the span boundaries. The timestamp column on a trace is an independent copy of end_time (the span completion time). Both fields are datetime.

traces | extend duration = end_time - start_time | where duration > 1s

Join column qualifiers

After a join, $left.<field> and $right.<field> disambiguate columns from each side of the join. They are syntactic qualifiers, not standalone fields — they must be followed by a field name.

table1
| join table2 on common_key
| extend left_value = $left.column_a
| extend right_value = $right.column_b
| extend left_dynamic = $left.$raw.custom_prop

$left or $right used alone is an error.